Little SQL Server Tricks: Support for TLS 1.2

When we tried our first attempt to disable unsecure protocols, we run into an annoying problem on the servers that run SQL Server. After disabling all the outdated security protocols, we could no longer connect to our databases. The error message was no help at all:

Could not connect to server: A connection was successfully established to the server, but then an error occurred during the pre-login handshake.

We had no other option than to postpone the switch to TLS 1.2 for the database servers until we figure out how to proceed. In the meantime I found this interesting article from Microsoft that explains our problem in great detail: TLS 1.2 support for Microsoft SQL Server

TLS 1.2 is an old protocol, but some SQL Server versions predate the support for that protocol. Therefore, those versions simply have no way to know what TLS 1.2 is an cannot use this protocol. With the article of Microsoft, you can check which is the first version that supports TLS 1.2 for SQL Server 2008, SQL Server 2008 R2, SQL Server 2012, and SQL Server 2014.

As an example: One of our oldest SQL Servers has the build number 12.0.4100.1, that stands for SQL Server 2014 SP1 (check this post to figure out how to map this number to a release). The article from Microsoft shows that the first release with TLS 1.2 is 12.0.4439.1 (SQL Server 2014 SP1 CU5). This means that we need to upgrade to at least CU 5 (CU = cumulative update) or install the latest patch (CU 13).

 

Conclusion

If you want to use TLS 1.2 and have an SQL Server version older than 2016, you should check the article from Microsoft to figure out if TLS 1.2 is even supported for your version. If not, you can decide if you upgrade to a supported SQL Server version or if you want to keep the older and no longer secure TLS versions around.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.